August 22, 2022

Emotet Resurgence: Cross-Industry Analysis

Technical insights on the Emotet resurgence in 2022 across various client environments, industries, and regions.

Inside the SOC

Darktrace cyber analysts are world-class experts in threat intelligence, threat hunting and incident response, and provide 24/7 SOC support to thousands of Darktrace customers around the globe. Inside the SOC is exclusively authored by these experts, providing analysis of cyber incidents and threat trends, based on real-world experience in the field.

Written by

Eugene Chua

Cyber Security Analyst

Aug 2022

Introduction

Last year provided further evidence that the cyber threat landscape remains both complex and challenging to predict. Between uncertain attribution, novel exploits and rapid malware developments, it is becoming harder to know where to focus security efforts. One of the largest surprises of 2021 was the re-emergence of the infamous Emotet botnet. This is an example of a campaign that ignored industry verticals or regions and seemingly targeted companies indiscriminately. Only 10 months after the Emotet takedown by law enforcement agencies in January, new Emotet activities in November were discovered by security researchers. These continued into the first quarter of 2022, a period which this blog will explore through findings from the Darktrace Threat Intel Unit.

Dating back to 2019, Emotet was known to deliver Trickbot payloads which ultimately deployed Ryuk ransomware strains on compromised devices. This interconnectivity highlighted the hydra-like nature of threat groups wherein eliminating one (even with full-scale law enforcement intervention) would not rule them out as a threat nor indicate that the threat landscape would be any more secure.

When Emotet resurged, as expected, one of the initial infection vectors involved leveraging existing Trickbot infrastructure. However, unlike the original attacks, it featured a brand new phishing campaign.

Figure 1: Distribution of observed Emotet activities across Darktrace deployments

Although similar to the original Emotet infections, the new wave of infections has been classified into two categories: Epochs 4 and 5. These had several key differences compared to Epochs 1 to 3. Within Darktrace’s global deployments, Emotet compromises associated to Epoch 4 appeared to be the most prevalent. Affected customer environments were seen within a large range of countries (Figure 1) and industry verticals such as manufacturing and supply chain, hospitality and travel, public administration, technology and telecoms and healthcare. Company demographics and size did not appear to be a targeting factor as affected customers had varying employee counts ranging from less than 250, to over 5000.

Key differences between Epochs 1-3 vs 4-5

Based on wider security research into the innerworkings of the Emotet exploits, several key differences were identified between Epochs 4/5 and its predecessors. The newer epochs used:

· A different Microsoft document format (OLE vs XML-based).

· A different encryption algorithm for communication. The new epochs used Elliptic Curve Cryptograph (ECC) [1] with public encryption keys contained in the C2 configuration file [2]. This was different from the previous Rivest-Shamir-Adleman (RSA) key encryption method.

· Control Flow Flattening was used as an obfuscation technique to make detection and reverse engineering more difficult. This is done by hiding a program’s control flow [3].

· New C2 infrastructure was observed as C2 communications were directed to over 230 unique IPs all associated to the new Epochs 4 and 5.

In addition to the new Epoch 4 and 5 features, Darktrace detected unsurprising similarities in those deployments affected by the renewed campaign. This included self-signed SSL connections to Emotet’s new infrastructure as well as malware spam activities to multiple rare external endpoints. Preceding these outbound communications, devices across multiple deployments were detected downloading Emotet-associated payloads (algorithmically generated DLL files).

Emotet Resurgence Campaign

Figure 2: Darktrace’s Detection Timeline for Emotet Epoch 4 and 5 compromises

1. Initial Compromise

The initial point of entry for the resurgence activity was almost certainly via Trickbot infrastructure or a successful phishing attack (Figure 2). Following the initial intrusion, the malware strain begins to download payloads via macro-ladened files which are used to spawn PowerShell for subsequent malware downloads.

Following the downloads, malicious communication with Emotet’s C2 infrastructure was observed alongside activities from the spam module. Within Darktrace, key techniques were observed and documented below.

2. Establish Foothold: Binary Dynamic-link library (.dll) with algorithmically generated filenames

Emotet payloads are polymorphic and contain algorithmically generated filenames . Within deployments, HTTP GET requests involving a suspicious hostname, www[.]arkpp[.]com, and Emotet related samples such as those seen below were observed:

· hpixQfCoJb0fS1.dll (SHA256 hash: 859a41b911688b00e104e9c474fc7aaf7b1f2d6e885e8d7fbf11347bc2e21eaa)

· M0uZ6kd8hnzVUt2BNbRzRFjRoz08WFYfPj2.dll (SHA256 hash: 9fbd590cf65cbfb2b842d46d82e886e3acb5bfecfdb82afc22a5f95bda7dd804)

· TpipJHHy7P.dll (SHA256 hash: 40060259d583b8cf83336bc50cc7a7d9e0a4de22b9a04e62ddc6ca5dedd6754b)

These DLL files likely represent the distribution of Emotet loaders which depends on windows processes such as rundll32[.]exe and regsvr32[.]exe to execute.

3. Establish Foothold: Outbound SSL connections to Emotet C2 servers

A clear network indicator of compromise for Emotet’s C2 communication involved self-signed SSL using certificate issuers and subjects which matched ‘CN=example[.]com,OU=IT Department,O=Global Security,L=London,ST=London,C=GB’ , and a common JA3 client fingerprint (72a589da586844d7f0818ce684948eea). The primary C2 communications were seen involving infrastructures classified as Epoch 4 rather than 5. Despite encryption in the communication content, network contextual connection details were sufficient for the detection of the C2 activities (Figure 3).

Figure 3: UI Model Breach logs on download and outbound SSL activities.

Outbound SSL and SMTP connections on TCP ports 25, 465, 587

An anomalous user agent such as, ‘Microsoft Outlook 15.0’, was observed being used for SMTP connections with some subject lines of the outbound emails containing Base64-encoded strings. In addition, this JA3 client fingerprint (37cdab6ff1bd1c195bacb776c5213bf2) was commonly seen from the SSL connections. Based on the set of malware spam hostnames observed across at least 10 deployments, the majority of the TLDs were .jp, .com, .net, .mx, with the Japanese TLD being the most common (Figure 4).

Figure 4: Malware Spam TLDs observed in outbound SSL and SMTP

Plaintext spam content generated from the spam module were seen in PCAPs (Figure 5). Examples of clear phishing or spam indicators included 1) mismatched personal header and email headers, 2) unusual reply chain and recipient references in the subject line, and 3) suspicious compressed file attachments, e.g. Electronic form[.]zip.

Figure 5: Example of PCAP associated to SPAM Module

4. Accomplish Mission

The Emotet resurgence also showed through secondary compromises involving anomalous SMB drive writes related to CobaltStrike. This consistently included the following JA3 hash (72a589da586844d7f0818ce684948eea) seen in SSL activities as well as SMB writes involving the svchost.exe file.

Darktrace Detection

The key DETECT models used to identify Emotet Resurgence activities were focused on determining possible C2. These included:

· Suspicious SSL Activity

· Suspicious Self-Signed SSL

· Rare External SSL Self-Signed

· Possible Outbound Spam

File-focused models were also beneficial and included:

· Zip or Gzip from Rare External Location

· EXE from Rare External Location

Darktrace’s detection capabilities can also be shown through a sample of case studies identified during the Threat Research team’s investigations.

Case Studies

Darktrace’s detection of Emotet activities was not limited by industry verticals or company sizing. Although there were many similar features seen across the new epoch, each incident displayed varying techniques from the campaign. This is shown in two client environments below:

When investigating a large customer environment within the public administration sector, 16 different devices were detected making 52,536 SSL connections with the example[.]com issuer. Devices associated with this issuer were mainly seen breaching the same Self-Signed and Spam DETECT models. Although anomalous incoming octet-streams were observed prior to this SSL, there was no clear relation between the downloads and the Emotet C2 connections. Despite the total affected devices occupying only a small portion of the total network, Darktrace analysts were able to filter against the much larger network ‘noise’ and locate detailed evidence of compromise to notify the customer.

Darktrace also identified new Emotet activities in much smaller customer environments. Looking at a company in the healthcare and pharmaceutical sector, from mid-March 2022 a single internal device was detected making an HTTP GET request to the host arkpp[.]com involving the algorithmically-generated DLL, TpipJHHy7P.dll with the SHA256 hash: 40060259d583b8cf83336bc50cc7a7d9e0a4de22b9a04e62ddc6ca5dedd6754b (Figure 6).

Figure 6: A screenshot from VirusTotal, showing that the SHA256 hash has been flagged as malicious by other security vendors.

After the sample was downloaded, the device contacted a large number of endpoints that had never been contacted by devices on the network. The endpoints were contacted over ports 443, 8080, and 7080 involving Emotet related IOCs and the same SSL certificate mentioned previously. Malware spam activities were also observed during a similar timeframe.

The Emotet case studies above demonstrate how autonomous detection of an anomalous sequence of activities - without depending on conventional rules and signatures - can reveal significant threat activities. Though possible staged payloads were only seen in a proportion of the affected environments, the following outbound C2 and malware spam activities involving many endpoints and ports were sufficient for the detection of Emotet.

If present, in both instances Darktrace’s Autonomous Response technology, RESPOND, would recommend or implement surgical actions to precisely target activities associated with the staged payload downloads, outgoing C2 communications, and malware spam activities. Additionally, restriction to the devices’ normal pattern of life will prevent simultaneously occurring malicious activities while enabling the continuity of normal business operations.

Conclusion

· The technical differences between past and present Emotet strains emphasizes the versatility of malicious threat actors and the need for a security solution that is not reliant on signatures.

· Darktrace’s visibility and unique behavioral detection continues to provide visibility to network activities related to the novel Emotet strain without reliance on rules and signatures. Key examples include the C2 connections to new Emotet infrastructure.

· Looking ahead, detection of C2 establishment using suspicious DLLs will prevent further propagation of the Emotet strains across networks.

· Darktrace’s AI detection and response will outpace conventional post compromise research involving the analysis of Emotet strains through static and dynamic code analysis, followed by the implementation of rules and signatures.

Thanks to Paul Jennings and Hanah Darley for their contributions to this blog.

Appendices

Model breaches

· Anomalous Connection / Anomalous SSL without SNI to New External

· Anomalous Connection / Application Protocol on Uncommon Port

· Anomalous Connection / Multiple Connections to New External TCP Port

· Anomalous Connection / Multiple Failed Connections to Rare Endpoint

· Anomalous Connection / Multiple HTTP POSTs to Rare Hostname

· Anomalous Connection / Possible Outbound Spam

· Anomalous Connection / Rare External SSL Self-Signed

· Anomalous Connection / Repeated Rare External SSL Self-Signed

· Anomalous Connection / Suspicious Expired SSL

· Anomalous Connection / Suspicious Self-Signed SSL

· Anomalous File / Anomalous Octet Stream (No User Agent)

· Anomalous File / Zip or Gzip from Rare External Location

· Anomalous File / EXE from Rare External Location

· Compromise / Agent Beacon to New Endpoint

· Compromise / Beacon to Young Endpoint

· Compromise / Beaconing Activity To External Rare

· Compromise / New or Repeated to Unusual SSL Port

· Compromise / Repeating Connections Over 4 Days

· Compromise / Slow Beaconing Activity To External Rare

· Compromise / SSL Beaconing to Rare Destination

· Compromise / Suspicious Beaconing Behaviour

· Compromise / Suspicious Spam Activity

· Compromise / Suspicious SSL Activity

· Compromise / Sustained SSL or HTTP Increase

· Device / Initial Breach Chain Compromise

· Device / Large Number of Connections to New Endpoints

· Device / Long Agent Connection to New Endpoint

· Device / New User Agent

· Device / New User Agent and New IP

· Device / SMB Session Bruteforce

· Device / Suspicious Domain

· Device / Suspicious SMB Scanning Activity

‍

For Darktrace customers who want to know more about using Darktrace to triage Emotet, refer here for an exclusive supplement to this blog.

References

[1] https://blog.lumen.com/emotet-redux/

[2] https://blogs.vmware.com/security/2022/03/emotet-c2-configuration-extraction-and-analysis.html

[3] https://news.sophos.com/en-us/2022/05/04/attacking-emotets-control-flow-flattening/

Written by

Eugene Chua

Cyber Security Analyst

Inside the SOC

Written by

Eugene Chua

Cyber Security Analyst

Product Marketing Manager, OT Security & Compliance

Watch the NIS2 Webinar

Blog

Network

November 27, 2025

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

What is TAG-150?

TAG-150, a relatively new Malware-as-a-Service (MaaS) operator, has been active since March 2025, demonstrating rapid development and an expansive, evolving infrastructure designed to support its malicious operations. The group employs two custom malware families, CastleLoader and CastleRAT, to compromise target systems, with a primary focus on the United States [1]. TAG-150’s infrastructure included numerous victim-facing components, such as IP addresses and domains functioning as command-and-control (C2) servers associated with malware families like SecTopRAT and WarmCookie, in addition to CastleLoader and CastleRAT [2].

As of May 2025, CastleLoader alone had infected a reported 469 devices, underscoring the scale and sophistication of TAG-150’s campaign [1].

What are CastleLoader and CastleRAT?

CastleLoader is a loader malware, primarily designed to download and install additional malware, enabling chain infections across compromised systems [3]. TAG-150 employs a technique known as ClickFix, which uses deceptive domains that mimic document verification systems or browser update notifications to trick victims into executing malicious scripts. Furthermore, CastleLoader leverages fake GitHub repositories that impersonate legitimate tools as a distribution method, luring unsuspecting users into downloading and installing malware on their devices [4].

CastleRAT, meanwhile, is a remote access trojan (RAT) that serves as one of the primary payloads delivered by CastleLoader. Once deployed, CastleRAT grants attackers extensive control over the compromised system, enabling capabilities such as keylogging, screen capturing, and remote shell access.

TAG-150 leverages CastleLoader as its initial delivery mechanism, with CastleRAT acting as the main payload. This two-stage attack strategy enhances the resilience and effectiveness of their operations by separating the initial infection vector from the final payload deployment.

How are they deployed?

Castleloader uses code-obfuscation methods such as dead-code insertion and packing to hinder both static and dynamic analysis. After the payload is unpacked, it connects to its command-and-control server to retrieve and running additional, targeted components.

Its modular architecture enables it to function both as a delivery mechanism and a staging utility, allowing threat actors to decouple the initial infection from payload deployment. CastleLoader typically delivers its payloads as Portable Executables (PEs) containing embedded shellcode. This shellcode activates the loader’s core module, which then connects to the C2 server to retrieve and execute the next-stage malware.[6]

Following this, attackers deploy the ClickFix technique, impersonating legitimate software distribution platforms like Google Meet or browser update notifications. These deceptive sites trick victims into copying and executing PowerShell commands, thereby initiating the infection kill chain. [1]

When a user clicks on a spoofed Cloudflare “Verification Step” prompt, a background request is sent to a PHP script on the distribution domain (e.g., /s.php?an=0). The server’s response is then automatically copied to the user’s clipboard using the ‘unsecuredCopyToClipboard()’ function. [7].

The Python-based variant of CastleRAT, known as “PyNightShade,” has been engineered with stealth in mind, showing minimal detection across antivirus platforms [2]. As illustrated in Figure 1, PyNightShade communicates with the geolocation API service ip-api[.]com, demonstrating both request and response behavior

Figure 1: Packet Capture (PCAP) of PyNightShade, the Python-based variant of CastleRAT, communicating with the geolocation API service ip-api[.]com.

Darktrace Coverage

In mid-2025, Darktrace observed a range of anomalous activities across its customer base that appeared linked to CastleLoader, including the example below from a US based organization.

The activity began on June 26, when a device on the customer’s network was observed connecting to the IP address 173.44.141[.]89, a previously unseen IP for this network along with the use of multiple user agents, which was also rare for the user. It was later determined that the IP address was a known indicator of compromise (IoC) associated with TAG-150’s CastleRAT and CastleLoader operations [2][5].

Figure 2: Darktrace’s detection of a device making unusual connections to the malicious endpoint 173.44.141[.]89.

The device was observed downloading two scripts from this endpoint, namely ‘/service/download/data_5x.bin’ and ‘/service/download/data_6x.bin’, which have both been linked to CastleLoader infections by open-source intelligence (OSINT) [8]. The archives contains embedded shellcode, which enables attackers to execute arbitrary code directly in memory, bypassing disk writes and making detection by endpoint detection and response (EDR) tools significantly more difficult [2].

Figure 3: Darktrace’s detection of two scripts from the malicious endpoint.

In addition to this, the affected device exhibited a high volume of internal connections to a broad range of endpoints, indicating potential scanning activity. Such behavior is often associated with reconnaissance efforts aimed at mapping internal infrastructure.

Darktrace / NETWORK correlated these behaviors and generated an Enhanced Monitoring model, a high-fidelity security model designed to detect activity consistent with the early stages of an attack. These high-priority models are continuously monitored and triaged by Darktrace’s Security Operations Center (SOC) as part of the Managed Threat Detection and Managed Detection & Response services, ensuring that subscribed customers are promptly alerted to emerging threats.

Figure 4: Darktrace detected an unusual ZIP file download alongside the anomalous script, followed by internal connectivity. This activity was correlated under an Enhanced Monitoring model.

Darktrace Autonomous Response

Fortunately, Darktrace’s Autonomous Response capability was fully configured, enabling it to take immediate action against the offending device by blocking any further connections external to the malicious endpoint, 173.44.141[.]89. Additionally, Darktrace enforced a ‘group pattern of life’ on the device, restricting its behavior to match other devices in its peer group, ensuring it could not deviate from expected activity, while also blocking connections over 443, shutting down any unwanted internal scanning.

Figure 5: Actions performed by Darktrace’s Autonomous Response to contain the ongoing attack.

Conclusion

The rise of the MaaS ecosystem, coupled with attackers’ growing ability to customize tools and techniques for specific targets, is making intrusion prevention increasingly challenging for security teams. Many threat actors now leverage modular toolkits, dynamic infrastructure, and tailored payloads to evade static defenses and exploit even minor visibility gaps. In this instance, Darktrace demonstrated its capability to counter these evolving tactics by identifying early-stage attack chain behaviors such as network scanning and the initial infection attempt. Autonomous Response then blocked the CastleLoader IP delivering the malicious ZIP payload, halting the attack before escalation and protecting the organization from a potentially damaging multi-stage compromise

Credit to Ahmed Gardezi (Cyber Analyst) Tyler Rhea (Senior Cyber Analyst)
Edited by Ryan Traill (Analyst Content Lead)

Appendices

Darktrace Model Detections

Anomalous Connection / Unusual Internal Connections
Anomalous File / Zip or Gzip from Rare External Location
Anomalous File / Script from Rare External Location
Initial Attack Chain Activity (Enhanced Monitoring Model)

MITRE ATT&CK Mapping

T15588.001 - Resource Development – Malware
TG1599 – Defence Evasion – Network Boundary Bridging
T1046 – Discovery – Network Service Scanning
T1189 – Initial Access

List of IoCs
IoC - Type - Description + Confidence

173.44.141[.]89 – IP – CastleLoader C2 Infrastructure
173.44.141[.]89/service/download/data_5x.bin – URI – CastleLoader Script
173.44.141[.]89/service/download/data_6x.bin – URI - CastleLoader Script
wsc.zip – ZIP file – Possible Payload

References

[1] - https://blog.polyswarm.io/castleloader

[2] - https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations

[3] - https://www.pcrisk.com/removal-guides/34160-castleloader-malware

[4] - https://www.scworld.com/brief/malware-loader-castleloader-targets-devices-via-fake-github-clickfix-phishing

[5] https://www.virustotal.com/gui/ip-address/173.44.141.89/community

[6] https://thehackernews.com/2025/07/castleloader-malware-infects-469.html

[7] https://www.cryptika.com/new-castleloader-attack-using-cloudflare-themed-clickfix-technique-to-infect-windows-computers/

[8] https://www.cryptika.com/castlebot-malware-as-a-service-deploys-range-of-payloads-linked-to-ransomware-attacks/

About the author

Blog

OT

November 20, 2025

Managing OT Remote Access with Zero Trust Control & AI Driven Detection

managing OT remote access with zero trust control and ai driven detection

The shift toward IT-OT convergence

Recently, industrial environments have become more connected and dependent on external collaboration. As a result, truly air-gapped OT systems have become less of a reality, especially when working with OEM-managed assets, legacy equipment requiring remote diagnostics, or third-party integrators who routinely connect in.

This convergence, whether it’s driven by digital transformation mandates or operational efficiency goals, are making OT environments more connected, more automated, and more intertwined with IT systems. While this convergence opens new possibilities, it also exposes the environment to risks that traditional OT architectures were never designed to withstand.

The modernization gap and why visibility alone isn’t enough

The push toward modernization has introduced new technology into industrial environments, creating convergence between IT and OT environments, and resulting in a lack of visibility. However, regaining that visibility is just a starting point. Visibility only tells you what is connected, not how access should be governed. And this is where the divide between IT and OT becomes unavoidable.

Security strategies that work well in IT often fall short in OT, where even small missteps can lead to environmental risk, safety incidents, or costly disruptions. Add in mounting regulatory pressure to enforce secure access, enforce segmentation, and demonstrate accountability, and it becomes clear: visibility alone is no longer sufficient. What industrial environments need now is precision. They need control. And they need to implement both without interrupting operations. All this requires identity-based access controls, real-time session oversight, and continuous behavioral detection.

The risk of unmonitored remote access

This risk becomes most evident during critical moments, such as when an OEM needs urgent access to troubleshoot a malfunctioning asset.

Under that time pressure, access is often provisioned quickly with minimal verification, bypassing established processes. Once inside, there’s little to no real-time oversight of user actions whether they’re executing commands, changing configurations, or moving laterally across the network. These actions typically go unlogged or unnoticed until something breaks. At that point, teams are stuck piecing together fragmented logs or post-incident forensics, with no clear line of accountability.

In environments where uptime is critical and safety is non-negotiable, this level of uncertainty simply isn’t sustainable.

The visibility gap: Who’s doing what, and when?

The fundamental issue we encounter is the disconnect between who has access and what they are doing with it.

Traditional access management tools may validate credentials and restrict entry points, but they rarely provide real-time visibility into in-session activity. Even fewer can distinguish between expected vendor behavior and subtle signs of compromise, misuse or misconfiguration.

As a result, OT and security teams are often left blind to the most critical part of the puzzle, intent and behavior.

Closing the gaps with zero trust controls and AI‑driven detection

Managing remote access in OT is no longer just about granting a connection, it’s about enforcing strict access parameters while continuously monitoring for abnormal behavior. This requires a two-pronged approach: precision access control, and intelligent, real-time detection.

Zero Trust access controls provide the foundation. By enforcing identity-based, just-in-time permissions, OT environments can ensure that vendors and remote users only access the systems they’re explicitly authorized to interact with, and only for the time they need. These controls should be granular enough to limit access down to specific devices, commands, or functions. By applying these principles consistently across the Purdue Model, organizations can eliminate reliance on catch-all VPN tunnels, jump servers, and brittle firewall exceptions that expose the environment to excess risk.

Access control is only one part of the equation

Darktrace / OT complements zero trust controls with continuous, AI-driven behavioral detection. Rather than relying on static rules or pre-defined signatures, Darktrace uses Self-Learning AI to build a live, evolving understanding of what’s “normal” in the environment, across every device, protocol, and user. This enables real-time detection of subtle misconfigurations, credential misuse, or lateral movement as they happen, not after the fact.

By correlating user identity and session activity with behavioral analytics, Darktrace gives organizations the full picture: who accessed which system, what actions they performed, how those actions compared to historical norms, and whether any deviations occurred. It eliminates guesswork around remote access sessions and replaces it with clear, contextual insight.

Importantly, Darktrace distinguishes between operational noise and true cyber-relevant anomalies. Unlike other tools that lump everything, from CVE alerts to routine activity, into a single stream, Darktrace separates legitimate remote access behavior from potential misuse or abuse. This means organizations can both audit access from a compliance standpoint and be confident that if a session is ever exploited, the misuse will be surfaced as a high-fidelity, cyber-relevant alert. This approach serves as a compensating control, ensuring that even if access is overextended or misused, the behavior is still visible and actionable.

If a session deviates from learned baselines, such as an unusual command sequence, new lateral movement path, or activity outside of scheduled hours, Darktrace can flag it immediately. These insights can be used to trigger manual investigation or automated enforcement actions, such as access revocation or session isolation, depending on policy.

This layered approach enables real-time decision-making, supports uninterrupted operations, and delivers complete accountability for all remote activity, without slowing down critical work or disrupting industrial workflows.

Where Zero Trust Access Meets AI‑Driven Oversight:

Granular Access Enforcement: Role-based, just-in-time access that aligns with Zero Trust principles and meets compliance expectations. ‍
Context-Enriched Threat Detection: Self-Learning AI detects anomalous OT behavior in real time and ties threats to access events and user activity. ‍
Automated Session Oversight: Behavioral anomalies can trigger alerting or automated controls, reducing time-to-contain while preserving uptime. ‍
Full Visibility Across Purdue Layers: Correlated data connects remote access events with device-level behavior, spanning IT and OT layers. ‍
Scalable, Passive Monitoring: Passive behavioral learning enables coverage across legacy systems and air-gapped environments, no signatures, agents, or intrusive scans required.

Complete security without compromise

We no longer have to choose between operational agility and security control, or between visibility and simplicity. A Zero Trust approach, reinforced by real-time AI detection, enables secure remote access that is both permission-aware and behavior-aware, tailored to the realities of industrial operations and scalable across diverse environments.

Because when it comes to protecting critical infrastructure, access without detection is a risk and detection without access control is incomplete.

About the author

Pallavi Singh

Product Marketing Manager, OT Security & Compliance

Your data. Our AI.

Elevate your network security with Darktrace AI

Get a demo

Emotet Resurgence: Cross-Industry Analysis

Introduction

Key differences between Epochs 1-3 vs 4-5

Emotet Resurgence Campaign

Darktrace Detection

Case Studies

Conclusion

Appendices

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

Managing OT Remote Access with Zero Trust Control & AI Driven Detection

Enjoying the blog?

More in this series

Blog

Network

November 27, 2025

CastleLoader & CastleRAT: Behind TAG150’s Modular Malware Delivery System

What is TAG-150?

What are CastleLoader and CastleRAT?

How are they deployed?

Darktrace Coverage

Darktrace Autonomous Response

Conclusion

Appendices

References

Blog

OT

November 20, 2025

Managing OT Remote Access with Zero Trust Control & AI Driven Detection

The shift toward IT-OT convergence

The modernization gap and why visibility alone isn’t enough

The risk of unmonitored remote access

The visibility gap: Who’s doing what, and when?

Closing the gaps with zero trust controls and AI‑driven detection

Access control is only one part of the equation

Where Zero Trust Access Meets AI‑Driven Oversight:

Complete security without compromise